News for hackers. Stuff that matters.

A comment on A website that auctions itself daily. Winner gets control of a Codex editor.

Re:A website that auctions itself daily. Winner gets control... by x______________ on Friday January 09, 2026 @05:00PM (#46559982)
Assuming the codex editor is the editor for the area below the auction counter, isn't that a security vulnerability that can put the site audience at risk?
[ Parent | on HN ]
Re:A website that auctions itself daily. Winner gets control... by nsomani on Friday January 09, 2026 @05:07PM (#46560064)
The Codex agent is only given tools to edit the single HTML file that displays on the homepage. The page is on a separate domain, so there's no cookie sharing, and the iFrame is in a sandbox. That said, the biggest risk is social engineering attacks.
[ Parent | on HN ]
Re:A website that auctions itself daily. Winner gets control... by hsbauauvhabzb on Saturday January 10, 2026 @12:40AM (#46563102)
What’s to stop someone rewriting the iframe wrapper to hide the real iframe and display a fake one?
[ Parent | on HN ]
Re:A website that auctions itself daily. Winner gets control... by nsomani on Saturday January 10, 2026 @05:16AM (#46564426)
They cannot edit the iFrame itself. The user is allowed to edit the contents within the iFrame.
[ Parent | on HN ]